Sleuth: Automated Verification of Software Power Analysis

Sleuth: Automated Verification of Software Power Analysis

Sleuth:
Automated Verification of
Software
Power Analysis
Countermeasures
Ali Galip Bayrak*, Francesco Regazzoni†,
David Novo*, and Paolo Ienne*
* Ecole Polytechnique Fédérale de Lausanne (EPFL)
† TU Delft and ALaRI University of Lugano
CHES 2013
Side-Channel Attacks and Protection
Unprotected first AddRoundKey of AES
void ARK() {
unsigned char i;
for (i=0;i<16;i++){
st[i] = pt[i] ˆ key[i];
}
}
Masked first AddRoundKey of AES
void maskedARK() {
unsigned char i;
for (i=0;i<16;i++){
st[i] = pt[i] ˆ
(key[i] ˆ mask[i]);
}
}
CHES 2013
pt[i]
key[i]
+
st[i]
key[i] mask[i] pt[i]
+
+
st
2
Verification (Functionality)
ct2 ✔
ct1 ✔
ct3 ✔
pt2
pt1
pt3
void maskedARK() {
unsigned char i;
for (i=0;i<16;i++){
st[i] = pt[i] ˆ
(key[i] ˆ mask[i]);
}
}
CHES 2013
✔
3
Verification (Security)
pt1
Power Consumption
1.8
1.6
1.4
1.2
1
0.8
0.6
0.4
0.2
0
1
CHES 2013
2
3
4
5
6
7
Time
8
9 10 11 12
4
Verification (Security)
pt2
pt1
Power Consumption
1.8
1.6
1.4
1.2
1
0.8
0.6
0.4
0.2
0
1
CHES 2013
2
3
4
5
6
7
Time
8
9 10 11 12
5
Verification (Security)
pt2
pt1
pt3
Power Consumption
1.8
1.6
1.4
1.2
1
0.8
0.6
0.4
0.2
0
1
CHES 2013
2
3
4
5
6
7
Time
8
9 10 11 12
6
Verification (Security)
pt2
pt1
pt3
key
✔
Power Consumption
1.8
1.6
1.4
1.2
1
0.8
0.6
0.4
0.2
0
1
CHES 2013
2
3
4
5
6
7
Time
8
9 10 11 12
7
Never Trust Your Compiler
void maskedARK() {
unsigned char i;
for (i=0;i<16;i++){
st[i] = pt[i] ˆ
(key[i] ˆ mask[i]);
}
}
avr-gcc-4.5.3 -O3
.text
.global ARK
.type
ARK, @function
ARK:
/* prologue: function */
/* frame size = 0 */
/* stack size = 0 */
.L__stack_usage = 0
lds r24,key
lds r25,pt
eor r24,r25
lds r25,mask
eor r24,r25
sts st,r24
lds r24,key+1
lds r25,pt+1
eor r24,r25
...
CHES 2013
8
Verification is Important
void maskedARK() {
unsigned char i;
for (i=0;i<16;i++){
st[i] = pt[i] ˆ
(key[i] ˆ mask[i]);
}
}
Sleuth
lds r24,key
lds r25,pt
eor r24,r25
Find the sensitive operations of a given program.
CHES 2013
9
Outline
• Sensitivity definitions
• Methodology
• Experimental studies
CHES 2013
10
Sensitivity Definitions
• Goal: Given a program, find the sensitive
operations, which leak critical information.
• Definitions we need:
– Program
– Types (secret, public, random)
– Leakage
– Sensitivity
CHES 2013
11
Program
• A sequence of
– branch-free
– three-address form
– arithmetic/logic or memory operations.
• Example:
key
key_r = key xor m1
pt_r = pt
xor m2
st
= pt_r xor key_r
Inputs: key, pt, m1, m2
pt
m2
m1
+
+
+
st
CHES 2013
12
Program
• A sequence of
– branch-free
• static analysis is exponentially complex for inputdependent branches.
• many countermeasures (e.g., masking, random
precharging) do not use such branches.
– three-address form
• x = y op z, x = y[z], or y[z] = x.
• for simplicity of representation.
– arithmetic/logic or memory operations.
CHES 2013
13
Type
• Each input is tagged with one of the types
– secret: content should not be revealed (e.g., key).
– public: content is observable by third-party (e.g.,
plaintext).
– random: uniformly distributed random values
(e.g., mask).
• Example:
key
pt
m1
m2
:
:
:
:
secret
public
random
random
CHES 2013
14
Leakage Model
• A model of the side-channel leakage (e.g.,
power consumption) of a device h, for a given
subset of operations d of a program p.
key m1
+
pt
m2
+st
key m1
+
+
pt
m2
+st
+
pt_r
HD
HW
HD(st, pt_r)
HW(st)
CHES 2013
15
Sensitivity
• For a given
– program p whose input variables {v0,…,vk-1} have
types {t0,…,tk-1},
– a device h,
– a leakage model l,
– sensitivity of a subset d’ of operations of p represents
whether leakage l(d’, p, h) depends on at least one
secret variable but not on any random variable.
CHES 2013
16
Sensitivity
key m1
+
pt
m2
+st
+
HW(st) = HW(key ⊕ m1⊕ pt ⊕ m2)
HW(st) ~ key ? : yes
HW(st) ~ m1 ? : yes
not sensitive
HW
HW(st)
CHES 2013
17
Sensitivity
key
+
pt
m1
+st
+
HW(st) = HW(key ⊕ pt)
HW(st) ~ key ? : yes
HW(st) ~ m1 ? : no
sensitive
HW
HW(st)
CHES 2013
18
Methodology
• Represent the program as a graph.
• Use satisfiability queries to detect the
dependencies and sensitivity.
CHES 2013
19
Graph Representation
public
pt
r0 = key ˆ m;
r1 = pt ˆ r0;
r2 = sm[r1];
secret random
m
key
+
+r0
LUTsm
0 1 101
…
r1
MUX
r2
Sample implementation in C
Graph representation
CHES 2013
20
Sensitivity Detection
public
pt
secret random
m
key
+
+r0
Is q1 sensitive?
• q1 ~ key?
• ¬ (q1 ~ m)?
LUTsm
0 1 101
…
r1
MUX
r2
HW
q1
CHES 2013
21
Dependency Check
pt key|0001 m
pt key&1110 m
+
+
LUTsm
0 1 101
…
Assign 0 to the last bit
+
+
LUTsm
0 1 101
…
MUX
MUX
HW
HW
Assign 1 to the last bit
≠
SAT?
22
Sleuth
Implementation
Type
Annotations
Queried
Operations
Leakage
Model
Sleuth
Sensitive
Operations
23
Experimental Studies
• Compilers are not perfect.
• Programmers are not perfect.
• Countermeasures are not perfect.
CHES 2013
24
Compiler Related Problems
• We used Hamming weight univariate leakage model.
• Detects all 16 such problems in 0.02 seconds.
• Similar problems arise in later operations (e.g., MixColumns).
It takes 430 seconds to detect all problems in a round of AES.
CHES 2013
25
Programmer Related Problems
• In the Boolean masking algorithm of Herbst et al. [19],
st[2] and st[10] use the same mask.
• We used Hamming distance leakage model.
• Bivariate leakage will be
HD(st[2], st[10]) = HD(st_orig[2]⊕ m, st_orig[10]⊕ m)
=
HW(st_orig[2]⊕ st_orig[10]).
• Finds all such problems (i.e.,
also between line 4 and 5) in 26
CHES 2013
477 seconds.
Countermeasure Related Problems
Find A such that
• If we use a proper leakage model an attack is possible
[Coron and Goubin ‘00].
• We used parity of the result as a leakage model.
• Finds in 0.02 seconds.
CHES 2013
27
Conclusions and Discussions
• Our SAT-based methodology is generic (does not
depend on the algorithm or countermeasure).
• We can find crucial real world problems (that can
invalidate the countermeasure) in a reasonable time.
• The user can make use of an extendible library of
leakage models.
CHES 2013
28
CHES 2013
29
CHES 2013
30